June 2008 - Darwin-dev - lists.apple.com

Re: What's the official way to detect a user has administration privileges?
by Stephen J. Butler 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=cBEYxpUz1sZYVdGDIx+GBqYmm+5rJXS2BoE1wEK0s+o=; b=r9rrLLV7ctpXAM3l30jEhkVGQ9Wg4XvDhiA6PVs7y9GOO96YLR84z8e2j9T+c8CvOT CLFuLKoXH5IJWM/R7QCg7MTMPMd82CakuaObgcFZ+4W70KCk4Dto1RuZVM0V2QXlpvM0 QwcP3FN7yo2pisNL+6+DoqIQ0DSsiiLzDwd+I= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=f/FdG9bvWjeiCQaT/X6Sad4zQLcEtBcouhIrZ5c5NAkElIwI04MbFOVq33xgICqxGy ITbGJ7kg/pNASebxu3rLC80gGUxBgOaxoq+LGA+V8kYCgybH9+vWFeG/2xRuXUMXKqNi 9DWSRjxlPkQTgdQybuDEHnBP4Zlq9LlnsQW00= On Tue, Jun 24, 2008 at 5:32 AM, Stéphane <ssudre(a)intego.com> wrote: > What's the official way to detect a user has administration privileges (from > a Mac OS X point of view)? > > OpenDirectory (how?) or does the fact that the user belongs to group admin > is enough (with the exception of root)? The best way to do what you want is to use the Authorization Services AuthorizationCopyRights: <http://developer.apple.com/documentation/Security/Reference/authorization_r…> Check for the "system.privilege.admin" right. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Alexander von Below 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Am 24.06.2008 um 19:39 schrieb Stephane Sudre: Alex _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… How do you check if "Allow user to administer this computer" is turned on for a specific user account? It feels like you're trying to second-guess the OS here - would it be better to simply attempt whatever it is you want to do, and if that fails due to lack of privileges (assuming you can detect that) retry with more privileges? Not in this case. But really, you should say what you are trying to accomplish. You can check if the user is in the admin group, that _should_ be consistent with the "Allow user to administrate" setting This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Stephane Sudre 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Jun 24, 2008, at 18:18, Chris Ridd wrote: On 24 Jun 2008, at 17:04, Stephane Sudre wrote: Maybe I should rephrase the question: Not in this case. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… How do you check if "Allow user to administer this computer" is turned on for a specific user account? It feels like you're trying to second-guess the OS here - would it be better to simply attempt whatever it is you want to do, and if that fails due to lack of privileges (assuming you can detect that) retry with more privileges? This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Chris Ridd 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On 24 Jun 2008, at 17:04, Stephane Sudre wrote: Maybe I should rephrase the question: Cheers, Chris _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… How do you check if "Allow user to administer this computer" is turned on for a specific user account? It feels like you're trying to second-guess the OS here - would it be better to simply attempt whatever it is you want to do, and if that fails due to lack of privileges (assuming you can detect that) retry with more privileges? This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Stephane Sudre 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Jun 24, 2008, at 12:42, Jean-Daniel Dupas wrote: On Jun 24, 2008, at 16:59, Graham.Lee(a)sophos.com wrote: Identity services has a serious flaw for me: it's Leopard only. Maybe I should rephrase the question: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… There is no administration privileges from a Mac OS X point of view. Each privileged task has its own rules defined in /etc/authorization In the case I'm thinking about: Mac OS X point of view == "Allow user to administer this computer" in System Preferences > Accounts > Security. Which is the way (I hope) most users see it. Identity services might help: http://developer.apple.com/documentation/Networking/Conceptual/ IdentityServices_ProgGuide/Introduction/chapter_1_section_1.html How do you check if "Allow user to administer this computer" is turned on for a specific user account? This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Paul Nelson 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcjWEBDQ4hZGbro12kew6vhEhnh08w== Thread-topic: What's the official way to detect a user has administration privileges? User-agent: Microsoft-Entourage/12.10.0.080409 There is also the dsmemberutil on Leopard. > From: Nigel Kersten <nigel(a)explanatorygap.net> > Date: Tue, 24 Jun 2008 08:20:25 -0700 > To: Stéphane <ssudre(a)intego.com> > Cc: <darwin-dev(a)lists.apple.com> > Subject: Re: What's the official way to detect a user has administration > privileges? > > > On Jun 24, 2008, at 3:32 AM, Stéphane wrote: > >> What's the official way to detect a user has administration >> privileges (from a Mac OS X point of view)? >> >> OpenDirectory (how?) or does the fact that the user belongs to group >> admin is enough (with the exception of root)? > > if you do just want to check whether a user is a member of the local > admin group (though as others have pointed out, this may not be what > you want) > > $ dseditgroup -o checkmember -m adminuser -n . admin ; echo $? > yes adminuser is a member of admin > 0 > > > $ dseditgroup -o checkmember -m notadmin -n . admin ; echo $? > no notadmin is NOT a member of admin > 2 > > > > > -- > Nigel Kersten > http://explanatorygap.net > > > > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-dev/nelson%40thursby.com > > This email sent to nelson(a)thursby.com > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Nigel Kersten 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Domainkey-status: no signature On Jun 24, 2008, at 3:32 AM, Stéphane wrote: $ dseditgroup -o checkmember -m adminuser -n . admin ; echo $? yes adminuser is a member of admin 0 $ dseditgroup -o checkmember -m notadmin -n . admin ; echo $? no notadmin is NOT a member of admin 2 -- Nigel Kersten http://explanatorygap.net _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… What's the official way to detect a user has administration privileges (from a Mac OS X point of view)? OpenDirectory (how?) or does the fact that the user belongs to group admin is enough (with the exception of root)? if you do just want to check whether a user is a member of the local admin group (though as others have pointed out, this may not be what you want) This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Graham.Lee＠sophos.com 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Stéphane wrote on 2008-06-24 11:32:57: > What's the official way to detect a user has administration > privileges (from a Mac OS X point of view)? Identity services might help: http://developer.apple.com/documentation/Networking/Conceptual/IdentityServ… although to expand on Jean-Daniel's reply, there's a difference between "being administrator" and "having privileges". Cheers, Graham. -- Graham Lee Senior Macintosh Software Engineer, Sophos Tel: 01235 540266 (Direct) Web: http://www.sophos.com Sophos - Security and Control Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, United Kingdom. Company Reg No 2096520. VAT Reg No GB 348 3873 20. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Jean-Daniel Dupas 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com http://developer.apple.com/documentation/Security/Conceptual/authorization_… Le 24 juin 08 à 12:32, Stéphane a écrit : _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/devlists%40shadowlab.org This email sent to devlists(a)shadowlab.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com There is no administration privileges from a Mac OS X point of view. Each privileged task has its own rules defined in /etc/authorization See "Performing Privileged Operations With Authorization Services" for details about Mac OS X authorization policy. What's the official way to detect a user has administration privileges (from a Mac OS X point of view)? OpenDirectory (how?) or does the fact that the user belongs to group admin is enough (with the exception of root)? smime.p7s

1 0

What's the official way to detect a user has administration privileges?
by Stéphane 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… What's the official way to detect a user has administration privileges (from a Mac OS X point of view)? OpenDirectory (how?) or does the fact that the user belongs to group admin is enough (with the exception of root)? This email sent to site_archiver(a)lists.apple.com

1 0